CVE-2026-24719: QTS, QuTS hero

Synopsis

A command injection vulnerability affects QNAP QTS and QuTS hero operating system versions prior to their respective fix builds. The flaw is reachable over the network but requires an attacker to first hold or obtain an administrator account; no victim interaction is needed. Successful exploitation lets an attacker run arbitrary operating system commands on the affected NAS device, giving full control over confidentiality, integrity, and availability. Patched-image rebuilds at QTS 5.2.9.3492 build 20260507 and QuTS hero h5.2.9.3499 build 20260514 are available on HarborGuard for environments running affected versions.

HarborGuard Coverage

Exploit Conditions

• Network reachabilityRequired

  The vulnerable service is exposed over the network, so an attacker must be able to reach it remotely to attempt exploitation.

• AuthenticationRequired

  An administrator-level account is required; the attacker must first acquire or compromise a privileged credential before the injection is reachable.

• Victim interactionNot required

  No action from a legitimate user is needed; the attacker operates entirely without victim participation.

• Attack complexityDetail

  Attack complexity is low, meaning the exploit is reliable and does not depend on race conditions, specific memory layouts, or other variable environmental factors.

Blast Radius

• A successful attacker executes arbitrary OS commands on the NAS with the privilege level of the service process.
• All data stored on the device is readable, exposing files, credentials, and configuration secrets.
• An attacker can modify or delete stored data, corrupting files and altering system configuration.
• The attacker can crash or suspend NAS services, making stored data and hosted applications unavailable.